PoC Index

CVE-2019-15849

HIGH 7.3EPSS 0.8%

eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system.

CVSS v3.1
7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v2.0
4.9 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
EPSS
0.82% chance of exploitation in the next 30 days, 55th percentile
Published
2019-10-17
Updated
2024-08-05

Proof-of-concept exploits (1)

References

Related